kernel: dm thin: Fix UAF in run_timer_softirq()

In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix UAF in runtimersoftirq When dmresume and dmdestroy are concurrent, it will lead to UAF, as follows: BUG: KASAN: use-after-free in runtimers+0x173/0x710 Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0 Cal...

kernel: dm integrity: Fix UAF in dm_integrity_dtr()

A use-after-free vulnerability was found in the Linux kernel's device mapper integrity subsystem. When dmresume and dmdestroy execute concurrently, a timer may fire and access freed memory because dmintegritydtr did not properly cancel the timer before freeing resources. The fix adds an additiona...

kernel: mm/damon/reclaim: fix potential memory leak in damon_reclaim_init()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/reclaim: fix potential memory leak in damonreclaiminit damonreclaiminit allocates a memory chunk for ctx with damonnewctx. When damonselectops fails, ctx is not released, which will lead to a memory leak. We should relea...

kernel: dm thin: Fix UAF in run_timer_softirq()

In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix UAF in runtimersoftirq When dmresume and dmdestroy are concurrent, it will lead to UAF, as follows: BUG: KASAN: use-after-free in runtimers+0x173/0x710 Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0 Cal...

kernel: dm clone: Fix UAF in clone_dtr()

A use-after-free vulnerability was found in the device-mapper clone target. When dmresume and dmdestroy execute concurrently, a timer may fire after the clone target structure has been freed, leading to use-after-free...

kernel: dm cache: free background tracker's queued work in btracker_destroy

A memory leak was found in the device-mapper cache target in the Linux kernel. The btrackerdestroy function fails to free queued work items from the background tracker before destroying the slab cache. This triggers a BUG when kmemcacheshutdown finds objects still remaining...

kernel: dm cache: Fix UAF in destroy()

In the Linux kernel, the following vulnerability has been resolved: dm cache: Fix UAF in destroy Dmcache also has the same UAF problem when dmresume and dmdestroy are concurrent. Therefore, cancelling timer again in destroy...

kernel: RDMA/irdma: Fix a window for use-after-free

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix a window for use-after-free During a destroy CQ an interrupt may cause processing of a CQE after CQ resources are freed by irdmacqfreersrc. Fix this by moving the call to irdmacqfreersrc after the...

Design/Logic Flaw

Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659...

CVE-2022-31647

Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659...

CVE-2022-31647: Improper Link Resolution Before File Access

Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659...

PT-2023-2595 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.6.0 Description: The issue is related to errors in handling symbolic links within the settings.DataFolder variable in the Docker Desktop for Windows platform. This can allow a remote attacker to gain read,...

PT-2025-49641

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0-rc4-01174-gb5d54eb5899a 7 Description The Linux kernel contains a use-after-free issue within the tcp write timer handler function. This occurs when the SMC SMC socket creates a kernel socket and the kernel...

PT-2025-40767

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to device mapper integrity. Specifically, the issue involves a memory leak in the journal io cache if dm register target fails during the dm...

PT-2025-40205

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s amdgpu display driver where a null pointer dereference could occur. Specifically, the adev-dm.dc pointer could be NULL and subsequently dereferenced...

PT-2023-36465

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57569 Crash type: Heap-buffer-overflow READ 8 Crash state: ucl object dtor unref single ucl object dtor unref ucl hash destroy...

Denial Of Service (DoS)

github.com/hashicorp/vault is vulnerable to Denial of Service DoS attacks. A malicious authenticated user is able to destroy the secret ID of any other role by providing the secret ID accessor via the /auth/approle/role/:rolename/secret-id-accessor/destroy endpoint, resulting in Denial of Service...

HashiCorp Vault 安全漏洞

HashiCorp Vault is a private key access management tool from HashiCorp USA. A security vulnerability exists in HashiCorp Vault and Vault Enterprise. An attacker exploited the vulnerability to destroy other user ids...

CVE-2023-24999 Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above...

CVE-2023-24999 Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above...